SPF, DKIM and DMARC Explained: Email Authentication for Store Owners

SPF, DKIM and DMARC are three DNS records that prove an email really came from your domain. Without them, anyone can send mail that claims to be from your store, and inbox providers have no way to tell your real newsletter from a scam. Gmail, Yahoo and Outlook now require them for bulk senders, so they are no longer optional for a store that does email marketing.

This guide explains each record in plain words, shows what they look like, walks through setup, and covers alignment, the detail that trips most people up. It ends with BIMI, the newer standard that shows your logo in some inboxes.

SPF (Sender Policy Framework) is a list of the servers and services allowed to send email for your domain. When a message arrives, the receiving server checks whether the sending server is on the list. A simple SPF record looks like this:

v=spf1 include:_spf.google.com include:sendingservice.example ~all

• v=spf1: Marks the record as SPF.
• include:: Adds another service's list of servers, such as your mailbox provider and your email marketing tool.
• ~all or -all: Says what to do with everyone else: ~all is "soft fail" (treat with suspicion), -all is "fail".

Two rules catch people out. You can have only one SPF record per domain, so add new services to the existing record instead of creating a second one. And SPF allows at most 10 DNS lookups: the standard, RFC 7208, section 4.6.4, says implementations must limit include, a, mx, ptr and exists mechanisms and the redirect modifier to 10, and going over returns a permanent error. Every include counts, and some includes contain more includes, so long records break quietly.

DKIM (DomainKeys Identified Mail) adds a digital signature to each email. Your sending service signs the message with a private key, and you publish the matching public key in DNS. The receiver uses it to check that the signature is valid and the message wasn't changed on the way.

The record lives under a "selector", a name your sending service chooses, such as s1._domainkey.yourstore.com. Each service you send from gets its own selector, so you can have several DKIM records without conflict. Your email tool gives you the exact name and value to publish.

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the address people see in the From line, tells receivers what to do with mail that fails, and asks them to send you reports. A starting record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourstore.com

• p=none: Monitor only. Receivers deliver as usual but send you reports. Gmail, Yahoo and Outlook accept this as the minimum for bulk senders.
• p=quarantine: Mail that fails goes to spam.
• p=reject: Mail that fails is refused.
• rua=: Where daily aggregate reports go. They show who is sending mail as your domain and whether it passes.

Start at p=none, read the reports for a few weeks to find every service that sends as you (your store, your help desk, your invoicing tool), fix the ones that fail, then move to quarantine and later reject. Jumping straight to reject can block your own legitimate mail.

DMARC passes only if SPF or DKIM passes and the domain it checked matches the domain in your From address. This is called alignment. A message can pass SPF for your email tool's domain and still fail DMARC if the From address says yourstore.com. The usual fix is DKIM signing with your own domain, which your email tool sets up when you add the DKIM record it gives you. Gmail's sender guidelines require bulk senders' From domain to align with SPF or DKIM.

• List every service that sends email as your domain: your mailbox provider, your store platform, your email marketing tool, help desk, invoicing and so on.
• In your DNS host (often your domain registrar or Cloudflare), find or create the SPF TXT record and include each service. Keep one record and count lookups.
• Add the DKIM records each sending service gives you.
• Add a DMARC record at _dmarc with p=none and an address for reports.
• Send test emails to Gmail and open "Show original" to confirm SPF, DKIM and DMARC all say PASS.
• Read DMARC reports for a few weeks, fix anything failing, then tighten the policy.

DNS changes can take time to show up everywhere. If a check fails right after you publish, wait and try again before changing the record.

BIMI (Brand Indicators for Message Identification) lets supporting inboxes show your logo next to your emails. It builds on DMARC rather than replacing it. Google's BIMI setup guide, checked October 19, 2026, says Gmail needs:

• A DMARC policy of quarantine or reject, with pct set to 100. Monitoring-only (p=none) doesn't qualify.
• A Verified Mark Certificate (VMC), which requires a trademarked logo, or a Common Mark Certificate (CMC) if your logo isn't trademarked.
• The logo in SVG Tiny Portable/Secure (SVG Tiny PS) format, at least 96 by 96 pixels.

BIMI is worth it for brands that already have strict DMARC and want the extra recognition. For most stores, getting SPF, DKIM and DMARC right comes first. SmartyTap doesn't set up BIMI for you; you would publish the BIMI record and certificate with your DNS host and certificate provider.

When you add a sending domain in SmartyTap, it gives you the DKIM record to publish, checks your domain's DNS records (including DKIM and DMARC) and tells you what still needs fixing. New sending domains then follow a warm-up schedule, and one-click unsubscribe and automatic suppression of bounces and complaints are built in. See email domain authentication in the docs.

SmartyTap Starter is $20 a month for 2,500 contacts, 25,000 emails and 250 SMS credits/segments. Pro is $199 a month (or $1,990 a year) for 25,000 contacts, 250,000 emails and 2,500 SMS credits/segments. One credit covers one segment and costs 2¢. New workspaces need a paid plan to send, and there's no free trial. See SmartyTap pricing.

Glossary: SPF, DKIM, DMARC and BIMI. Read next: email deliverability guide, how to clean your email list, email marketing for Shopify and Black Friday email and SMS checklist.

SPF lists which servers may send mail for your domain. DKIM signs each message so receivers can confirm it came from your domain unchanged. DMARC checks that one of them matches your From address, tells receivers what to do when they don't, and sends you reports.

If you send in bulk, yes. Gmail, Yahoo and Outlook require SPF, DKIM and a DMARC record (at least p=none) for bulk senders (checked October 19, 2026), and all three improve inbox placement for smaller senders too.

No. A domain should have exactly one SPF record. Two records cause SPF to fail. Combine every service into one record and keep it under 10 DNS lookups.

Start with p=none and a reporting address. Once the reports show all your legitimate mail passing, move to p=quarantine, then p=reject.